Archive
August 2021
Vulnerabilities first published in this month (UTC), newest first.
2,107 results · Feed
-
Unscored —
A session fixation vulnerability exists in Citrix ADC and Citrix Gateway 13.0-82.45 when configured SAML service provid…
-
Unscored —
A vulnerability has been identified in Citrix Virtual Apps and Desktops that could, if exploited, allow a user of a Win…
-
High 8.1
Deserialization of Untrusted Data in com.supermartijn642.configlib.ConfigSyncPacket
SuperMartijn642's Config Lib is a library used by a number of mods for the game Minecraft. The versions of SuperMartijn642's Config Lib between 1.0.4 and 1.0.8 are affected by a vulnerability and can be exploited on both servers and clients. Using SuperMartij…
-
High 8.8
Youtube Feeder <= 2.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
The Youtube Feeder WordPress plugin is vulnerable to Cross-Site Request Forgery via the printAdminPage function found in the ~/youtube-feeder.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.0.1.
-
High 8.8
Nifty Newsletters <= 4.0.23 - Cross-Site Request Forgery to Stored Cross-Site Scripting
The Nifty Newsletters WordPress plugin is vulnerable to Cross-Site Request Forgery via the sola_nl_wp_head function found in the ~/sola-newsletters.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 4.0.23.
-
High 8.8
A use-after-free vulnerability exists in the JavaScript engine of Foxit Software’s PDF Reader, version 11.0.0.49893. A …
-
High 8.8
A use-after-free vulnerability exists in the JavaScript engine of Foxit Software’s PDF Reader, version 10.1.3.37598. A …
-
High 8.8
A use-after-free vulnerability exists in the JavaScript engine of Foxit Software’s PDF Reader, version 10.1.4.37651. A …
-
Medium 6.5
An information disclosure vulnerability exists in the IOCTL 0x9c40a148 handling of IOBit Advanced SystemCare Ultimate 1…
-
Medium 6.5
An information disclosure vulnerability exists in the the way IOBit Advanced SystemCare Ultimate 14.2.0.220 driver hand…
-
Medium 6.5
An information disclosure vulnerability exists in the the way IOBit Advanced SystemCare Ultimate 14.2.0.220 driver hand…
-
Medium 6.5
An information disclosure vulnerability exists in the the way IOBit Advanced SystemCare Ultimate 14.2.0.220 driver hand…
-
Critical 9.8
An OS Command Injection vulnerability exists in the ping.php script functionality of Advantech R-SeeNet v 2.4.12 (20.10…
-
High 8.8
A unsafe deserialization vulnerability exists in the ComponentModel Profile.FromFile() functionality of CODESYS GmbH CO…
-
Unscored —CVE-2021-3679 Public exploit
A lack of CPU resource in the Linux kernel tracing module functionality in versions prior to 5.14-rc3 was found in the …
-
Unscored —
A flaw was found in the USB redirector device emulation of QEMU in versions prior to 6.1.0-rc2. It occurs when dropping…
-
Unscored —
ZTE's big video business platform has two reflective cross-site scripting (XSS) vulnerabilities. Due to insufficient in…
-
Unscored —
A ZTE's product of the transport network access layer has a security vulnerability. Because the system does not suffici…
-
Unscored —
If Thunderbird was configured to use STARTTLS for an IMAP connection, and an attacker injected IMAP server responses pr…
-
Unscored —
A malicious webpage could have triggered a use-after-free, memory corruption, and a potentially exploitable crash. *Thi…
-
Unscored —
If a user had granted a permission to a webpage and saved that grant, any webpage running on the same host - irrespecti…
-
Unscored —
A use-after-free vulnerability was found via testing, and traced to an out-of-date Cairo library. Updating the library …
-
Unscored —
Password autofill was enabled without user interaction on insecure websites on Firefox for Android. This was corrected …
-
Unscored —
When network partitioning was enabled, e.g. as a result of Enhanced Tracking Protection settings, a TLS error page woul…
-
Unscored —
Through a series of DOM manipulations, a message, over which the attacker had control of the text but not HTML or forma…
-
Unscored —
Mozilla developers reported memory safety bugs present in code shared between Firefox and Thunderbird. Some of these bu…
-
Unscored —
Mozilla developers reported memory safety bugs present in Firefox 89. Some of these bugs showed evidence of memory corr…
-
Unscored —
Multiple low security issues were discovered and fixed in a security audit of Mozilla VPN 2.x branch as part of a 3rd p…
-
Unscored —
Improper access control vulnerability in Smart Touch Call prior to version 1.0.0.5 allows arbitrary webpage loading in …
-
Unscored —
Improper access control vulnerability in SmartThings prior to version 1.7.67.25 allows untrusted applications to cause …
-
Unscored —
Improper access control vulnerability in SmartThings prior to version 1.7.67.25 allows untrusted applications to cause …
-
Unscored —
Unprotected component vulnerability in Samsung Internet prior to version 14.2 allows untrusted application to access in…
-
Unscored —
An IV reuse vulnerability in keymaster prior to SMR AUG-2021 Release 1 allows decryption of custom keyblob with privile…
-
Unscored —
A use after free vulnerability in conn_gadget driver prior to SMR AUG-2021 Release 1 allows malicious action by an atta…
-
High 7.1
Reflected XSS in OAuth Flow
Fixed a bypass for a reflected cross-site scripting vulnerability affecting OAuth-enabled instances of Mattermost.
-
Low 3.5
Denial-of-Service (DoS) Vulnerability
A Denial-of-Service (DoS) vulnerability was discovered in F-Secure Atlant whereby the SAVAPI component used in certain F-Secure products can crash while scanning fuzzed files. The exploit can be triggered remotely by an attacker. A successful attack will resu…
-
High 8.8
NewsPlugin <= 1.0.18 - Cross-Site Request Forgery to Stored Cross-Site Scripting
The NewsPlugin WordPress plugin is vulnerable to Cross-Site Request Forgery via the handle_save_style function found in the ~/news-plugin.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.18.
-
Critical 9.8
Deserialization of Untrusted Data in Neo4j
Neo4j through 3.4.18 (with the shell server enabled) exposes an RMI service that arbitrarily deserializes Java objects, e.g., through setSessionVariable. An attacker can abuse this for remote code execution because there are dependencies with exploitable gadg…
-
Unscored —
In certain Progress MOVEit Transfer versions before 2021.0.3 (aka 13.0.3), SQL injection in the MOVEit Transfer web app…
-
High 8.7
An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.0. It was possible to exploit a st…